CWE-284 · Improper Access Control (page 74)
Page 74 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10333 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS. |
CVE-2015-9029 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. |
CVE-2015-9024 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. |
CVE-2015-9021 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled. |
CVE-2014-9961 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection. |
CVE-2016-7833 | High | 7.5 | 2017-06-09 | Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary format) file via unspeci… |
CVE-2016-7824 | High | 8.8 | 2017-06-09 | Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via uns… |
CVE-2016-7811 | High | 8.8 | 2017-06-09 | Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations v… |
CVE-2016-7807 | High | 7.5 | 2017-06-09 | I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into… |
CVE-2016-7801 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors. |
CVE-2016-4910 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters… |
CVE-2016-4908 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unsp… |
CVE-2016-6098 | High | 8.1 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or mo… |
CVE-2015-2692 | Critical | 10.0 | 2017-06-08 | AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters. |
CVE-2016-3112 | High | 7.5 | 2017-06-08 | client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote auth… |
CVE-2016-3107 | Medium | 5.5 | 2017-06-08 | The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allow… |
CVE-2015-3295 | Medium | 5.3 | 2017-06-07 | markdown-it before 4.1.0 does not block data: URLs. |
CVE-2016-6089 | Medium | 5.5 | 2017-06-07 | IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper ac… |
CVE-2016-0768 | High | 7.5 | 2017-06-06 | PostgreSQL PL/Java after 9.0 does not honor access controls on large objects. |
CVE-2015-9006 | High | 7.8 | 2017-06-06 | In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist. |
CVE-2017-8438 | High | 8.8 | 2017-06-05 | Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specif… |
CVE-2017-6016 | High | 7.3 | 2017-05-19 | An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affec… |
CVE-2016-10237 | High | 7.8 | 2017-05-16 | If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF u… |
CVE-2016-10370 | High | 7.5 | 2017-05-11 | An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow f… |
CVE-2016-10369 | High | 7.8 | 2017-05-08 | unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch… |
CVE-2016-7054 | High | 7.5 | 2017-05-04 | In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can… |
CVE-2016-9976 | High | 8.4 | 2017-05-03 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL re… |
CVE-2016-2930 | High | 7.5 | 2017-05-03 | IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512. |
CVE-2016-8588 | High | 7.3 | 2017-04-28 | The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell me… |
CVE-2016-8587 | High | 7.3 | 2017-04-28 | dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archi… |
CVE-2016-8584 | Critical | 9.8 | 2017-04-28 | Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessi… |
CVE-2016-5551 | Low | 2.8 | 2017-04-24 | Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected… |
CVE-2015-0104 | High | 8.8 | 2017-04-24 | IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo… |
CVE-2016-2433 | High | 8.8 | 2017-04-21 | The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context… |
CVE-2016-1518 | High | 8.1 | 2017-04-21 | The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers… |
CVE-2016-3733 | Medium | 4.3 | 2017-04-20 | The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated u… |
CVE-2016-3729 | Medium | 6.5 | 2017-04-20 | The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to… |
CVE-2016-4850 | High | 8.1 | 2017-04-20 | LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. |
CVE-2016-1220 | Medium | 4.3 | 2017-04-20 | Cybozu Garoon before 4.2.2 does not properly restrict access. |
CVE-2016-6338 | Medium | 6.8 | 2017-04-20 | ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to b… |
CVE-2016-6337 | High | 7.5 | 2017-04-20 | MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function a… |
CVE-2016-6336 | Medium | 6.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppres… |
CVE-2016-6331 | High | 7.5 | 2017-04-20 | ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via… |
CVE-2016-4874 | Low | 3.5 | 2017-04-17 | Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack. |
CVE-2016-7032 | High | 7.0 | 2017-04-14 | sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) syst… |
CVE-2016-4032 | Medium | 4.6 | 2017-04-13 | Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9… |
CVE-2016-4031 | Medium | 6.8 | 2017-04-13 | Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9… |
CVE-2016-4030 | Medium | 6.8 | 2017-04-13 | Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9… |
CVE-2016-6143 | Critical | 9.8 | 2017-04-13 | SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806. |
CVE-2016-4800 | Critical | 9.8 | 2017-04-13 | The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource rest… |
CVE-2015-8284 | High | 8.8 | 2017-04-13 | SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions. |
CVE-2016-1178 | Medium | 6.5 | 2017-04-12 | The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via u… |
CVE-2016-6605 | High | 7.5 | 2017-04-10 | Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization. |
CVE-2016-5058 | High | 7.5 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay. |
CVE-2016-5054 | High | 7.5 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay. |
CVE-2015-8275 | Medium | 5.5 | 2017-04-10 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files. |
CVE-2015-7265 | High | 7.5 | 2017-04-10 | Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. |
CVE-2015-7263 | High | 7.5 | 2017-04-10 | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. |
CVE-2014-3930 | High | 7.5 | 2017-04-03 | lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresse… |
CVE-2014-3929 | High | 7.5 | 2017-04-03 | The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to… |
CVE-2014-3928 | Critical | 9.8 | 2017-04-03 | Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials. |
CVE-2016-8798 | High | 7.5 | 2017-04-02 | Huawei USG5500 with software V300R001C00 and V300R001C00 allows attackers to bypass the anti-DDoS module of the USGs to cause a denial of service condition on… |
CVE-2016-8794 | High | 7.1 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8793 | Medium | 6.7 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8792 | High | 7.1 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8791 | High | 7.1 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8274 | High | 7.8 | 2017-04-02 | Huawei PC client software HiSuite 4.0.5.300_OVE has a dynamic link library (DLL) hijack vulnerability; an attacker can make the system load malicious DLL files… |
CVE-2016-8273 | High | 7.8 | 2017-04-02 | Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software packa… |
CVE-2014-4707 | High | 8.8 | 2017-04-02 | Huawei Campus S7700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300; S9300 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C0… |
CVE-2016-8032 | High | 7.3 | 2017-03-31 | Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection… |
CVE-2015-4624 | High | 7.5 | 2017-03-31 | Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens. |
CVE-2016-6807 | Critical | 9.8 | 2017-03-28 | Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect… |
CVE-2016-9468 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed… |
CVE-2016-9467 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files… |
CVE-2016-9462 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Ne… |
CVE-2016-9461 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was… |
CVE-2016-9460 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app w… |
CVE-2016-9122 | High | 7.5 | 2017-03-28 | go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a… |
CVE-2016-10144 | Critical | 9.8 | 2017-03-24 | coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check. |
CVE-2016-10130 | Medium | 5.9 | 2017-03-24 | The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by le… |
CVE-2015-8627 | Medium | 5.3 | 2017-03-23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded oc… |
CVE-2016-7468 | Medium | 5.9 | 2017-03-23 | An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerab… |
CVE-2016-5750 | High | 8.8 | 2017-03-23 | The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would… |
CVE-2016-5747 | High | 7.5 | 2017-03-23 | A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intend… |
CVE-2016-5239 | Critical | 9.8 | 2017-03-15 | The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vecto… |
CVE-2016-8010 | High | 7.8 | 2017-03-14 | Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier al… |
CVE-2016-8007 | Medium | 6.3 | 2017-03-14 | Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the pr… |
CVE-2015-8987 | Medium | 5.3 | 2017-03-14 | Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make… |
CVE-2014-9920 | Medium | 5.9 | 2017-03-14 | Unauthorized execution of binary vulnerability in McAfee (now Intel Security) McAfee Application Control (MAC) 6.0.0 before hotfix 9726, 6.0.1 before hotfix 90… |
CVE-2013-7461 | Medium | 5.5 | 2017-03-14 | A write protection and execution bypass vulnerability in McAfee (now Intel Security) Change Control (MCC) 6.1.0 for Linux and earlier allows authenticated user… |
CVE-2013-7460 | Medium | 5.5 | 2017-03-14 | A write protection and execution bypass vulnerability in McAfee (now Intel Security) Application Control (MAC) 6.1.0 for Linux and earlier allows authenticated… |
CVE-2016-9368 | High | 7.5 | 2017-03-14 | An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform resource locator (URL… |
CVE-2016-9245 | Medium | 5.9 | 2017-03-07 | In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with B… |
CVE-2016-6255 | High | 7.5 | 2017-03-07 | Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handle… |
CVE-2016-8236 | High | 7.5 | 2017-03-03 | Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than… |
CVE-2016-10065 | High | 7.8 | 2017-03-03 | The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have othe… |
CVE-2016-7408 | High | 8.8 | 2017-03-03 | The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. |
CVE-2016-10193 | Critical | 9.8 | 2017-03-03 | The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes… |
CVE-2016-9818 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP. |
CVE-2016-9817 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR… |